agentic-workflow-manager 3.9.1 → 3.11.0

package/dist/tests/commands/sensors/run.test.js

@@ -86,6 +86,79 @@ describe('runSensors', () => {
         expect(sec.status).toBe('skipped');
         expect(sec.skipReason).toBe('disabled');
     });
+    it('dispatches by the formatter field, not the sensor name — ruff on a `lint` sensor', async () => {
+        // The whole point of the `formatter` field: a `lint` sensor is eslint for
+        // js-ts but ruff for python. Old name-based dispatch (lint -> eslint parser)
+        // would choke on ruff's flat JSON array (no `.messages` — TypeError) instead
+        // of parsing it. Real captured `ruff --output-format json` shape.
+        const pythonManifest = {
+            pack: 'python',
+            sensors: {
+                lint: { cmd: 'ruff check . --output-format json', fast: true, formatter: 'ruff' },
+            },
+        };
+        fs_1.default.writeFileSync(path.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify(pythonManifest));
+        const ruffJson = JSON.stringify([{
+                code: 'F401',
+                filename: path.join(tmpDir, 'bad.py'),
+                location: { row: 1, column: 8 },
+                message: '`os` imported but unused',
+            }]);
+        mockRunCommand.mockResolvedValueOnce(exited(1, ruffJson));
+        const { runSensors } = load();
+        const result = await runSensors({ fast: true, cwd: tmpDir });
+        const lint = result.sensors.find((s) => s.name === 'lint');
+        expect(lint.status).toBe('fail');
+        expect(lint.errors[0].rule).toBe('F401');
+        expect(lint.errors[0].message).toMatch('SENSOR[lint]');
+        expect(lint.errors[0].message).toMatch('imported but unused');
+    });
+    it('falls back to name-based dispatch when formatter is absent (pre-existing manifest)', async () => {
+        // A manifest written before the `formatter` field existed must keep working
+        // exactly as before: `lint` -> eslint parser, no `formatter` key anywhere.
+        mockRunCommand
+            .mockResolvedValueOnce(exited(1, 'src/a.ts(1,1): error TS0001: Bad type.'))
+            .mockResolvedValueOnce(exited(1, JSON.stringify([{ filePath: '/x/a.js', messages: [{ ruleId: 'no-unused-vars', severity: 2, message: 'unused', line: 1, column: 1 }] }])));
+        const { runSensors } = load();
+        const result = await runSensors({ fast: true, cwd: tmpDir });
+        const lint = result.sensors.find((s) => s.name === 'lint');
+        expect(lint.status).toBe('fail');
+        expect(lint.errors[0].rule).toBe('no-unused-vars');
+    });
+    it('degrades to the generic formatter (never a wrong-shape misparse) for an unrecognized formatter value', async () => {
+        // Regression for Finding 5: `formatter: 'bandit'` is present but not one of the
+        // 8 known values. The OLD behavior fell through to name-based dispatch — sensor
+        // name 'security' -> parseSemgrepOutput — which would silently misparse
+        // bandit's differently-shaped `results` entries (no `path`/`start`/`check_id`
+        // keys) into garbage findings (`file: undefined, line: 0`). The fix must use
+        // parseGenericOutput instead: an honest raw-wrap, never a wrong-shape guess.
+        const banditManifest = {
+            pack: 'python',
+            sensors: {
+                security: { cmd: 'bandit -r . -f json', fast: false, formatter: 'bandit' },
+            },
+        };
+        fs_1.default.writeFileSync(path.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify(banditManifest));
+        // Real bandit JSON shape (fields semgrep's parser does not know how to read).
+        const banditJson = JSON.stringify({
+            results: [
+                { filename: 'app.py', line_number: 12, test_id: 'B105', issue_text: 'hardcoded password' },
+            ],
+        });
+        mockRunCommand.mockResolvedValueOnce(exited(1, banditJson));
+        const { runSensors } = load();
+        const result = await runSensors({ all: true, cwd: tmpDir });
+        const sec = result.sensors.find((s) => s.name === 'security');
+        expect(sec.status).toBe('fail');
+        expect(sec.errors).toHaveLength(1);
+        // Never the semgrep-misparse shape (file: undefined, line: 0, rule: undefined).
+        expect(sec.errors[0].file).toBeUndefined();
+        expect(sec.errors[0].line).toBeUndefined();
+        expect(sec.errors[0].rule).toBeUndefined();
+        // The honest generic raw-wrap: the raw JSON, verbatim, inside one message.
+        expect(sec.errors[0].message).toMatch('SENSOR[raw]');
+        expect(sec.errors[0].message).toContain('B105');
+    });
     const tcError = () => exited(1, 'src/a.ts(1,1): error TS0001: Bad type.');
     it('baseline suppresses accepted findings — sensor passes on no NEW findings', async () => {
         const { runSensors } = load();
@@ -160,6 +233,24 @@ describe('runSensors — missing tool is a fail, not a skip', () => {
         expect(out.overall).toBe('fail');
     });
 });
+describe('runSensors — sensors: null in a hand-edited manifest', () => {
+    // Regression for Finding 3: `checkManifest` (preflight) already guards
+    // `manifest.sensors ?? {}` — runSensors' `Object.entries(activeManifest.sensors)`
+    // needs the same guard, or a corrupted/hand-edited `.awm/sensors.json` with
+    // `"sensors": null` crashes `Object.entries(null)`, taking down the whole run.
+    it('degrades gracefully instead of throwing when sensors is null', async () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-null-sensors-'));
+        fs_1.default.mkdirSync(path_1.default.join(dir, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), JSON.stringify({ pack: 'python', sensors: null }));
+        try {
+            const result = await (0, run_1.runSensors)({ cwd: dir, all: true });
+            expect(result.sensors).toEqual([]);
+        }
+        finally {
+            fs_1.default.rmSync(dir, { recursive: true });
+        }
+    });
+});
 describe('runSensors — not_certified + auto-discovery', () => {
     let tmpDir;
     beforeEach(() => {

package/dist/tests/commands/sensors/status.test.js

@@ -109,6 +109,35 @@ describe('computeSensorStatus', () => {
             expect(result.checks.security.ok).toBe(true);
         });
     });
+    it('is DEGRADED (never HEALTHY) when the manifest has zero sensor entries', () => {
+        // `Object.values({}).every(...)` is vacuously true — guard against reading an
+        // empty manifest (the honest floor when the registry had no pack.json for the
+        // detected stack) as a clean run that found nothing wrong.
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'python',
+            sensors: {},
+        }));
+        const result = (0, status_1.computeSensorStatus)(tmpDir);
+        expect(result.overall).toBe('DEGRADED');
+        expect(result.pack).toBe('python');
+    });
+    it('degrades gracefully (never throws) when sensors is null in a hand-edited manifest', () => {
+        // Regression for Finding 3: `checkManifest` (preflight) already guards
+        // `manifest.sensors ?? {}` — computeSensorStatus needs the same guard, or a
+        // corrupted/hand-edited manifest with `"sensors": null` crashes
+        // `Object.entries(null)`.
+        fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'python',
+            sensors: null,
+        }));
+        expect(() => (0, status_1.computeSensorStatus)(tmpDir)).not.toThrow();
+        const result = (0, status_1.computeSensorStatus)(tmpDir);
+        expect(result.overall).toBe('DEGRADED');
+        expect(result.pack).toBe('python');
+        expect(result.checks).toEqual({});
+    });
     it('marks disabled sensors as ok', () => {
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({

package/dist/tests/core/paths.test.js

@@ -5,7 +5,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 const paths_1 = require("../../src/core/paths");
+jest.mock('child_process', () => ({ execSync: jest.fn() }));
+const mockExecSync = child_process_1.execSync;
 describe('core/paths', () => {
     let origHome;
     let origAwmHome;
@@ -13,6 +16,7 @@ describe('core/paths', () => {
     beforeEach(() => {
         origHome = process.env.HOME;
         origAwmHome = process.env.AWM_HOME;
+        mockExecSync.mockReset();
     });
     afterEach(() => {
         if (origHome === undefined)
@@ -75,4 +79,34 @@ describe('core/paths', () => {
         (0, paths_1.warnIfUnsupportedPlatform)(log);
         expect(calls).toEqual([paths_1.WINDOWS_NATIVE_WARNING]);
     });
+    describe('resolveOnPath', () => {
+        it('uses `command -v` on POSIX and returns true when the binary resolves', () => {
+            setPlatform('linux');
+            mockExecSync.mockImplementation(((cmd) => {
+                if (cmd === 'command -v semgrep')
+                    return Buffer.from('/usr/bin/semgrep');
+                throw new Error(`not found: ${cmd}`);
+            }));
+            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(true);
+        });
+        it('returns false on POSIX when `command -v` fails to resolve the binary', () => {
+            setPlatform('linux');
+            mockExecSync.mockImplementation(() => { throw new Error('not found'); });
+            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(false);
+        });
+        it('uses `where` on win32, not `command -v`', () => {
+            setPlatform('win32');
+            mockExecSync.mockImplementation(((cmd) => {
+                if (cmd === 'where semgrep')
+                    return Buffer.from('C:\\tools\\semgrep.exe');
+                throw new Error(`not found: ${cmd}`);
+            }));
+            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(true);
+        });
+        it('returns false on win32 when `where` cannot find the binary', () => {
+            setPlatform('win32');
+            mockExecSync.mockImplementation(() => { throw new Error('not found'); });
+            expect((0, paths_1.resolveOnPath)('semgrep')).toBe(false);
+        });
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "3.9.1",
+  "version": "3.11.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"